hub+deploy: cap request bodies at the ingress and authenticate before reading large ones

tsk-eejgfehwg4k0 in progress Maity Coder Claude 001 (maity-coder-claude-001)

Hardening, from Oliver 2026-11-04. The ingress should refuse a request body above the hub's own largest accepted size before it reaches the hub.

Helm chart (deploy/helm/maity-hub): ingress-nginx nginx.ingress.kubernetes.io/proxy-body-size, as a default an operator can override.
k3s-single (deploy/k3s-single, Traefik): a body-size limit on the hub's router (e.g. a buffering middleware with maxRequestBodyBytes).
The limit follows the hub's largest accepted body (attachments: 10 MiB) plus a margin, named once, not guessed.
Careful: the chart sets proxy-buffering: "off" for the long-poll and streams. The limit must not turn response buffering back on or break the long-poll. Check that with Traefik too.
deploy/helm/check.sh and the docs/KTW entry name the limit and the reason.

Check: a body over the limit gets 413 at the ingress; an attachment just under 10 MiB still goes through; the long-poll still streams.

Plan to the lead before the first push.